Add pd: peering-degree Blend Monte-Carlo graph simulator
Static-graph simulator quantifying how a node's peering degree trades off
propagation speed, adversary exposure, deanonymization, and reliability in the
Blend network. Scales to 1e6 nodes (sparse CSR + sampled Dijkstra); the
adversary and deanonymization metrics are exact at every N.
Model (ms): seeded d-regular peer graph (matching-union), Blend cascade
(sender -> blend_hops timed-release mix relays -> final flood), geographic link
base + exponential transport jitter, per-node processing lag, free-running
release-clock mixing.
Metrics:
- propagation: full-delay mean/p50/p90/p99, path/broadcast split, coverage times
- reliability: message success-delivery-rate ~ (1-unresponsive_frac)^blend_hops
and flood coverage, with unresponsive nodes modelled as routing holes
- adversary (exact): observed/eclipsed fractions, random + worst-case placement
- deanonymization (exact): P(whole blend path adversarial) ~ f_adv^blend_hops,
and full deanonymization (path adversarial AND honest sender peered with an
adversary) = deanon_rate * observed_frac
Deterministic blake2b seed streams, three parquet tables, joblib parallelism,
memguard, an analytic verify harness, 50 unit tests, and an auto-installing
Makefile.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-08-03 16:47:46 +02:00
|
|
|
import dataclasses
|
|
|
|
|
|
|
|
|
|
import pytest
|
|
|
|
|
|
|
|
|
|
from pd.config import SimConfig, SweepConfig
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_key_covers_every_field():
|
|
|
|
|
fields = [f.name for f in dataclasses.fields(SimConfig)]
|
|
|
|
|
assert len(SimConfig().key()) == len(fields)
|
|
|
|
|
base = SimConfig()
|
|
|
|
|
for name in fields:
|
|
|
|
|
cur = getattr(base, name)
|
|
|
|
|
alt = {"n_nodes": 2000, "degree": 4, "blend_hops": 2, "max_blend_delay": 5,
|
Add linkability, messaging redundancy and churn percolation to pd; report
Extends the pd Blend simulator along two axes the deanonymization model
opened up, adds the reports/blend/pd report of record, and fixes three
correctness defects found while reviewing the result.
Linkability over time (pd.linkability):
- time to link an emitter ~ 30s*ln(1/(1-alpha))/(stake*q): inversely
proportional to stake, so a 5% staker is linked in ~2 days and a 0.001%
staker only after ~27 years;
- time to certify a node's stake >= theta from the count of attributable
observations (relative precision ~1/sqrt(N)): sizing a node costs 100-400x
more than identifying it, and sub-0.1% stake is practically unlearnable.
Both are closed forms over the exact deanonymization rates and a
stake-proportional 30 s emission cadence, checked against a Monte-Carlo of
the emission process in verify.
Messaging redundancy (R independent cascades per emission, R = 1..4):
- `redundancy` knob threaded through config/rng/propagation/engine/metrics/
sweep; a node receives from whichever cascade reaches it first, so arrival
times combine element-wise. Delivery and capture both follow 1-(1-x)^R, so
redundancy trades reliability against anonymity and divides time-to-link
by ~R. Measured: delivery 0.34 -> 0.81 at 30% churn for R = 1 -> 4, while a
1%-staker's time to link falls 10 d -> 2.5 d.
- Redundancy buys NO coverage: a cascade only delivers if the sender could
already route to its relay, so every delivered cascade floods the sender's
own component. Coverage is flat in R to four decimals at every degree.
- Near the percolation threshold the cascades fail together rather than
independently, so redundancy under-delivers against 1-(1-p1)^R there.
Churn percolation (configs/percolation.yaml, verify check 7):
- the flood only crosses responsive nodes, so it lives on the responsive
sub-graph -- site percolation on a d-regular graph. A network survives churn
only up to u_c = 1 - 1/(degree-1); measured collapse lands on the predicted
threshold for every degree (3 -> 0.50, 6 -> 0.80, 16 -> 0.93), which inverts
into the sizing rule degree > 1 + 1/(1-u).
Correctness fixes:
- redundancy delay used the fastest cascade's own full delay, which
over-states it (min-max vs max-min); now the element-wise earliest arrival,
reducing exactly to the single-cascade model at R = 1 (test);
- the "redundancy improves coverage" claim was false in both the report and
the simulator README -- removed and replaced with the measured result;
- per-hop latency is degree-dependent (1.5 s at degree 16 to 2.7 s at degree
3), not a flat 1.6 s; and the worst-case observation figure was averaged
over degrees -- at degree 8 and f_adv = 0.2 it is 0.83 -> 1.000.
Statistics: round counts raised for resolution rather than speed -- 8000
rounds per cell in the main sweep, 9600 in the redundancy study, 6400 in the
percolation study, giving SEM <= 0.009 on every delivery rate and <= 0.04 s
on every delay mean. The previous redundancy grid (144 rounds/cell) produced a
non-monotonic delivery curve; it is now monotonic and within 0.015 of theory.
Adversary and deanonymization metrics remain closed-form and exact.
reports/blend/pd: the report of record -- peering-degree trade-offs across
speed, observation, eclipse, deanonymization and reliability, plus the
time-to-link, stake-inference, redundancy and churn-threshold sections, with
21 figures of record and an explicit sampling-error statement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 22:37:22 +02:00
|
|
|
"unresponsive_frac": 0.2, "redundancy": 2, "n_rounds": 10,
|
|
|
|
|
"transport_jitter_mean_ms": 1.0,
|
Add pd: peering-degree Blend Monte-Carlo graph simulator
Static-graph simulator quantifying how a node's peering degree trades off
propagation speed, adversary exposure, deanonymization, and reliability in the
Blend network. Scales to 1e6 nodes (sparse CSR + sampled Dijkstra); the
adversary and deanonymization metrics are exact at every N.
Model (ms): seeded d-regular peer graph (matching-union), Blend cascade
(sender -> blend_hops timed-release mix relays -> final flood), geographic link
base + exponential transport jitter, per-node processing lag, free-running
release-clock mixing.
Metrics:
- propagation: full-delay mean/p50/p90/p99, path/broadcast split, coverage times
- reliability: message success-delivery-rate ~ (1-unresponsive_frac)^blend_hops
and flood coverage, with unresponsive nodes modelled as routing holes
- adversary (exact): observed/eclipsed fractions, random + worst-case placement
- deanonymization (exact): P(whole blend path adversarial) ~ f_adv^blend_hops,
and full deanonymization (path adversarial AND honest sender peered with an
adversary) = deanon_rate * observed_frac
Deterministic blake2b seed streams, three parquet tables, joblib parallelism,
memguard, an analytic verify harness, 50 unit tests, and an auto-installing
Makefile.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-08-03 16:47:46 +02:00
|
|
|
"processing_lags_ms": (11.0, 51.0, 101.0), "processing_lag_probs": (0.6, 0.3, 0.1),
|
|
|
|
|
"link_latency_dist": "fixed", "link_latency_mean_ms": 1.0,
|
|
|
|
|
"coverage_pcts": (25.0,), "f_adv": 0.1, "adversary_mode": "worstcase_coverage",
|
|
|
|
|
"n_placements": 1, "worstcase_max_n": 5, "graph_seed": 99, "replicate": 1,
|
|
|
|
|
"root_seed": 7}[name]
|
|
|
|
|
assert alt != cur
|
|
|
|
|
assert dataclasses.replace(base, **{name: alt}).key() != base.key(), name
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.mark.parametrize("kw", [
|
|
|
|
|
{"n_nodes": 999}, # odd
|
|
|
|
|
{"degree": 1000}, # >= n
|
|
|
|
|
{"blend_hops": 0}, # < 1
|
|
|
|
|
{"f_adv": 1.0}, # >= 1
|
|
|
|
|
{"max_blend_delay": -1},
|
|
|
|
|
{"processing_lag_probs": (0.5, 0.4)}, # doesn't sum to 1 (with default 3 lags -> len mismatch)
|
|
|
|
|
{"link_latency_dist": "bogus"},
|
|
|
|
|
{"adversary_mode": "bogus"},
|
|
|
|
|
])
|
|
|
|
|
def test_validation_rejects(kw):
|
|
|
|
|
with pytest.raises(ValueError):
|
|
|
|
|
SimConfig(**kw)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_sweep_grids_and_collapse():
|
|
|
|
|
sw = SweepConfig(n_nodes=[1000, 10000], degree=[4, 8], blend_hops=[2, 3],
|
|
|
|
|
max_blend_delay=[0, 3], f_adv=[0.0, 0.2],
|
|
|
|
|
adversary_mode=["random", "worstcase_coverage"], seeds=3)
|
|
|
|
|
assert len(sw.graph_cells()) == 2 * 2 * 3
|
|
|
|
|
assert len(sw.prop_grid()) == 2 * 2
|
|
|
|
|
# f_adv=0 collapses to a single (mode-irrelevant) row; f_adv=0.2 keeps both modes
|
|
|
|
|
assert sw.adv_grid() == [(0.0, "random"), (0.2, "random"), (0.2, "worstcase_coverage")]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_from_dict_rejects_unknown():
|
|
|
|
|
with pytest.raises(ValueError):
|
|
|
|
|
SweepConfig.from_dict({"nonsense": [1]})
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_base_config_coerces_tuples():
|
|
|
|
|
sw = SweepConfig(base={"processing_lags_ms": [10.0, 90.0], "processing_lag_probs": [0.3, 0.7]})
|
|
|
|
|
cfg = sw.base_config(1000, 8, 0)
|
|
|
|
|
assert cfg.processing_lags_ms == (10.0, 90.0)
|
|
|
|
|
assert isinstance(cfg.key(), tuple)
|